UNIVERSITY OF 


OXFORD 


Response to the Information Commissioner’s Office consultation on its Age Appropriate 
Design Code 


Professor Marina Jirotka and Dr Helena Webb, Human Centred Computing Group, 
Department of Computer Science, University of Oxford 


In this document we set out our response to the Information Commissioner’s Office (ICO) consultation 
on its draft code of practice for online services likely to be accessed by children. Our response is 
underpinned the findings of our research work conducted at the University of Oxford. 


Currently in the UK, researchers and developers who are working in the digital economy are 
experiencing great uncertainty about where responsibilities lie for tackling harmful outcomes of 
technological innovation. There are so many controversies about who should, for example, monitor 
the actions of algorithms or remedy unfairness and bias in machine learning. These questions of 
responsibility are often driven by economic considerations, but the issues run much deeper and are 
implicated in a wider reshaping of institutional, cultural and democratic responses to governing 
technology. How to divide responsibilities in the digital economy between developers, civic 
authorities, users of the technology and automated systems, represents a series of yet unsolved 
problems. Responsibility does not simply refer to accountability and liability; it also incorporates care 
towards technological users and citizens in general, plus responsiveness to emerging issues and 
concerns. 


There are significant challenges involved in embedding responsibility into processes of technological 
innovation and it is our belief that this Design Code takes an important step towards achieving this in 
relation to the handling of children’s personal data by online services. Responsible data handling is a 
critical issue in the contemporary digital economy and requires regulatory attention. We therefore 
welcome work in this area. We particularly welcome the focus on children: young people have specific 
vulnerabilities online and as such, require specific care and protections towards them. The Design 
Code is a strong acknowledgement of this. The Code also recognises that young people’s online 
experience and needs differ at different stages of their development and accordingly sets out its 
recommendations in relation to different age ranges. As a result, the Code provides a comprehensive 
list of standards to foster the responsible handling of data and respect towards the rights of young 
people by online services. 


Our research work at the University of Oxford highlights the value of responsibility and identifies 
mechanisms to promote it. Two recent RCUK funded projects have focused on the online experiences 
of young people. These are: Digital Wildfire: (Mis)information flows, propagation and responsible 
governance (ESRC), and UnBias - emancipating users against algorithmic biases for a trusted digital 
economy (EPSRC). The findings of both projects highlighted the vulnerability of young people online 
in relation to being harmed by content they may see whilst browsing, repercussions of the content 
they post themselves, and being harmed by the treatment of their personal data for the purposes of 
filtering and personalisation. These harms can take a wide variety of forms and can have long term 
consequences. It is therefore vital that a code of practice for online services recognises the different 


May 2019 


UNIVERSITY OF 


OXFORD 


forms of harms that can be caused to young people online and takes a wide-ranging view of practices 
that can avoid or mitigate harms when they occur. 


Promoting age appropriate design in this field is extremely complex; there are nuances around 
determining and applying relevant age ranges for children, and it can be very difficult to identify and 
assess all potential risks and harms. However, in our view, the 16 draft standards in the Design Code 
provided are comprehensive, well defined and technically achievable. For instance, the default for 
high privacy and geolocation off can bring about positive impact with relatively little practical 
complexity. In addition, transparent privacy information and online tools can be easily provided in an 
age appropriate and accessible manner. 


In our projects we have spent a great deal of time engaging with young people, their parents/carers, 
and schools. In the ‘Digital Wildfire’ project we visited a number of schools and also ran youth panel 
competitions to elicit young people’s views on social media. This work revealed the importance young 
people place on their online experience; as digital natives it is often a key part of their identity and 
social community, bringing many benefits as well as risking certain harms. Their own experiences of 
being online are nuanced and interwoven with the details of their lives. Young people also feel a strong 
sense of justice that they should be treated fairly by online providers as well as a sense of care towards 
others. Similarly, parents/carers, teachers and others with a responsibility towards children form part 
of the networks they live in and have views on their online rights and protections. We argue that in 
order to establish — and then act on — what is in the best interests of the child, it is important to engage 
with these networks directly. Therefore, we welcome draft standard 1 and to achieve it in full, 
developers should interact with relevant stakeholders in order to unpick and understand children’s 
online experiences and best interests. They can then form part of a community that serves to care and 
take responsibility for young people online. We also argue that this community should consider the 
best interests of the child as relating not only to protection against harm, but also education for young 
people and the promotion of digital resilience. Young people are sometimes unclear of the details of 
how and why their data are collected, and the short and long term consequences this can have. As set 
out in draft standard 3, information needs to be provided to young people clearly and transparently. 
Furthermore, it is in children’s best interests that they are supported in finding ways to recover when 
they have encountered harms and develop strategies to prevent or deal with similar risks in future. 


In our ‘UnBias’ project we also spent a great deal of time interacting with young people; in this case 
asking them about their experience and knowledge of online filtering and personalisation 
mechanisms. Once again, we found that young people have a strong sense of justice, for themselves 
and others, with regard to what they are shown when browsing, how their data are handled and what 
consequences this can have. For instance, they can feel inconvenienced or even unfairly targeted by 
some of the personalised advertising they are shown when browsing. They are also concerned about 
the long term and cumulative implications of data tracking and filtering - for themselves, their peers 
and for society as whole. Draft standard 7 is therefore crucial to reducing the risks perceived by young 
people. We further suggest that draft standard 4 should incorporate a long-term view of what 
constitutes detrimental use of data. Protections should be put in place even when the harm or risk of 
harm cannot be discerned in the short term. 


Connected toys and devices are rapidly growing in popularity and likely to become a standard feature 
in many young people’s lives. There have already been controversies over how such devices collect 
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and handle children’s personal data, so it is vital that they are incorporated into the Code, as set out 
in draft standard 13. In our current research project (RoboTIPS: Developing Responsible Robots for 
the Digital Economy, EPSRC) we are incorporating connected toys and games devices as part of our 
focus on social robots. We are developing and trialling explainer systems for social robots that can be 
used in investigation procedures to determine how an incident or accident occurred. This will help to 
avoid similar incidents or accidents in future and form transparency mechanisms to enhance 
stakeholder trust in social robots. As part of the project we will also be engaging with designers and 
developers to discuss how responsibility can be embedded into social robots, including in the ways 
they collect and handle personal data. 


Our final comment refers to the recently published (May 2019) report ‘Building Ethical Data Policies 
for the Public Good’. This report was produced by the All Party Parliamentary Group on Data Analytics, 
of which Professor Jirotka is a Steering Committee member. Its first recommendation states: To build 
public confidence and acceptability, providers of public services should address ethics as part of their 
‘licence to operate’. A core principle should be that the public’s views on data exploitation are 
proactively built into an ethical assessment at the service design stage. We believe that ethics as a 
licence to operate is a fundamental principle to foster responsibility in technological innovation. We 
suggest that the same principle supports this Design Code. Proactive attention to ethics, ethical 
assessment and public views can form the cornerstone of responsible conduct by online services 
providers. 
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